Lucene search

MitreCVE-2016-6793

HistoryJul 17, 2017 - 1:18 p.m.

CVE-2016-6793

2017-07-1713:18:06

CWE-502

mitre

web.nvd.nist.gov

cve-2016-6793

diskfileitem class

apache wicket

denial of service

remote code execution

nvd

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.024

Percentile

90.1%

JSON

The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem, and if running on a Java VM before 1.3.1, execute arbitrary code via a crafted serialized Java object.

Affected configurations

Nvd

Node

apachewicketRange1.5.0–1.5.17

apachewicketRange6.0.0–6.25.0

VendorProductVersionCPE
apachewicket*cpe:2.3:a:apache:wicket:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	wicket	*	cpe:2.3:a:apache:wicket::::::::

References

www.openwall.com/lists/oss-security/2016/12/31/1

www.securityfocus.com/archive/1/539975/100/0/threaded

www.securityfocus.com/bid/95168

www.securitytracker.com/id/1037541

wicket.apache.org/news/2016/12/31/cve-2016-6793.html

www.tenable.com/security/research/tra-2016-23

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.024

Percentile

90.1%

JSON

Related for CVE-2016-6793